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A recent study performed for the Aerocapture Technology Area in the In-Space 
Propulsion Technology Projects Office at the Marshall Space Flight Center investigated the 
relative risk of various capture techniques for Mars missions. Aerocapture has been 
proposed as a possible capture technique for future Mars missions but has been perceived by 
many in the community as a higher risk option as compared to aerobraking and propulsive 
capture. By performing a probabilistic risk assessment on aerocapture, aerobraking and 
propulsive capture, a comparison was made to uncover the projected relative risks of these 
three maneuvers. For mission planners, this knowledge will allow them to decide if the mass 
savings provided by aerocapture warrant any incremental risk exposure. The study focuses 
on a Mars Sample Return mission currently under investigation at the Jet Propulsion 
Laboratory (JPL). In each case (propulsive, aerobraking and aerocapture), the Earth 
return vehicle is inserted into Martian orbit by one of the three techniques being 
investigated. A baseline spacecraft was established through initial sizing exercises 
performed by JPL’s Team X. While Team X design results provided the baseline and 
common thread between the spacecraft, in each case the Team X results were supplemented 
by historical data as needed. Propulsion, thermal protection, guidance, navigation and 
control, software, solar arrays, navigation and targeting and atmospheric prediction were 
investigated. A qualitative assessment of human reliability was also included. Results show 
that different risk drivers contribute significantly to each capture technique. For 
aerocapture, the significant drivers include propulsion system failures and atmospheric 
prediction errors. Software and guidance hardware contribute the most to aerobraking 
risk. Propulsive capture risk is mainly driven by anomalous solar array degradation and 
propulsion system failures. While each subsystem contributes differently to the risk of each 
technique, results show that there exists little relative difference in the reliability of these 
capture techniques although uncertainty for the aerocapture estimates remains high given 
the lack of in-space demonstration. 


Nomenclature 

Tum.m = Mean value of the Limit Temperature of the Bond-line Material 

Tapp,m = Mean value of the internal TPS as result of applied heat load 

T i>m = Mean value of initial internal temperature of TPS 
Tiimj = Coefficient of Variation of the TPS Bond-line Temperature 

j = Coefficient of Variation of the applied TPS temperature 

R ~ Reliability 

X ~ Failure Rate 
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= Time 

= Number of errors prior to debugging 
= Number of errors after first debugging interval 
= Time of test interval 
~ Total test time 
*= Operational time 
= Solar Array Degradation Factor 

~ Percentage of Solar Array Degradation Failure that contributes to loss of mission (1%) 


I. Introduction 

As part of an on- going effort within the In-Space Propulsion Technology Projects Office at the Marshall Space 
Flight Center (MSFC) to investigate the benefits and drawbacks of aerocapture, a study has been conducted to 
compare the relative risk of capture techniques for a Mars mission. The probabilistic risk assessment of aerocapture, 
aerobraking and propulsive capture for a Mars sample return mission should provide insight into the true degree of 
risk differential between these three techniques. While aerocapture has been investigated for many years as a 
possible method for capturing payloads into planetary orbits, most of the systems analyses have focused on 
performance-based benefits of this emerging technology. Meanwhile, an underlying current has developed within 
the in-space propulsion community which presumes that this technology is inherently higher risk than other, more 
traditional capture methods. 

A short investigation was performed to uncover the reasons for not selecting aerocapture as a capture method in 
past mission planning efforts. During early mission planning efforts for the Mars Odyssey mission (then referred to 
as the Mars Surveyor 2001 Orbiter mission), aerocapture was the planned capture technique 15 . At the time it was 
believed that human missions to Mars would soon follow and that aerocapture would be an enabling technology for 
such missions. It was therefore decided that the Mars Surveyor 2001 Orbiter would be the test-bed for aerocapture 
technology. While some technical issues were addressed early in the mission planning and design, including 
aeroshell packaging and mass concerns for such a small mission, no true risk analysis was performed before the 
decision was made to change the capture technique to aerobraking. It was believed that the spacecraft would be less 
expensive and easier to develop if previous aerobraking experience was leveraged for capture at Mars. Because 
Mars Global Surveyor and Mars Climate Orbiter were both slated to use aerobraking, a decision was made to use 
aerobraking for Mars Odyssey as well. 

In the years following Mars Odyssey, investigation into materials for aeroshells, guidance algorithms for 
atmospheric flight control and the development of a better general understanding of the aerothermal environment 
that exists during aerocapture have led to greater definition of the technical hurdles that exist in the development of 
aerocapture. The goal of this study is to provide quantitative results that compare the relative risk of aerocapture, 
aerobraking and propulsive capture so that the true level of risk can be fairly assessed. The overall understanding of 
relative risks will aid technology developers and mission planners in choosing the appropriate capture methods for 
future missions. 

It is important to note that the numbers presented as results from this study assume that an Earth demonstrator 
mission has already been performed for aerocapture. This assumption was made in order to level the playing field 
with the other technologies that have already been flown numerous times. Previous flight experience reduces the 
risk in several ways. Most prominent is the proof that the subsystems are properly integrated to provide a favorable 
outcome. Alternately, if a previous mission fails and the source of the failure can be determined, this can also 
reduce the risk by leading to design changes. For example, the loss of the Mars Climate Orbiter led to the design of 
hypergolic-propellant-based propulsion systems with separate pressurization elements to eliminate the failure mode 
of back-flow mixing leading to catastrophic loss. Thus, propulsive systems are now safer due to lessons learned in 
previous flights, successful or not. It is estimated that without an Earth demonstrator, the risk of aerocapture may be 
30 to 50% higher than the numbers used to create the relative risks presented as a result of this study. This is an 
estimate of the risk reduction achieved by an Earth demonstrator mission based on historical data from initial flights 
of select launch vehicles and spacecraft. 
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II. PRA Methodology 

Probabilistic Risk Assessment (PRA) is defined by NASA’s Office of Safety and Mission Assurance as a 
comprehensive, structured, and logical analysis method aimed at identifying and assessing risks in complex 
technological systems for the purpose of cost-effectively improving their safety and performance 2 . For this study, 
risk models were developed for each of the three capture maneuvers to assess the relative risk between them. 
Assessing the relative risk of each maneuver was deemed the most time-efficient method for providing useful 
results, as opposed to developing full-scale risk models for each capture method. Risk assessments such as this one 
provide a bottoms-up approach to analyzing systems that are operated differently for the three maneuvers. The 
process for this model development starts with data collection at the component or material level from applicable 
sources. Then, actual physical parameters of the three capture methods are applied to the data where appropriate. 
Fault tree or event tree logic is subsequently utilized to aggregate failure probabilities that lead to an undesirable 
consequence, i.e., loss of mission. Finally, subsystem risks are combined to obtain an overall risk assessment of the 
systems analyzed and further relative comparisons are calculated by normalizing results to a particular maneuver. 
Also, where appropriate, dormancy or latent failures were applied to the risk models to account for failures that 
occur when a component is in a non-energized state but realized when the component is called upon for subsequent 
operations. For all three maneuvers, risk assessment begins with the Mars orbit insertion bum and ends with arrival 
in final parking orbit, with the exception of latent failures incurred during Earth-Mars transit. An example of a fault 
tree can be seen in Figure 1. 



Figure 1: Example Fault Tree for Any Capture Method 


III. Mission Overview 

The study focused on a Mars Sample Return mission currently under investigation at the Jet Propulsion 
Laboratory (JPL). Though the capture technique is varied in each case, the basic mission scenario applies to all 
cases studied. A schematic of each of the three capture methods can be found in Figure 2. Two spacecraft are 
delivered to Mars: a lander and an Earth return vehicle (ERV). The lander performs a direct entry, landing on the 
surface of Mars. Soil and rock samples are collected with either a robotic arm or a rover. Samples are placed in a 
small ascent vehicle and launched into orbit to rendezvous with the ERV for trans-Earth injection. While in Mars 
orbit, the ERV provides a communications link between the surface and Earth and locates, captures and retrieves the 
sample container for the trip back to Earth. 


3 

American Institute of Aeronautics and Astronautics 











Hyperbolic 

Approach 



Atmosphere 

Final ERV 
Parking Orbit 


MOI Burn 


Propulsive Capture 


Periapsis 
Raise Bum 

X 


Hyperbolic 

Approach 


Atmosphere 



Final ERV 
Parking Orbit 


Single 
Atmospheric 
Pass 



Aerocapture 

Figure 2: Capture Technique Schematics (not to scale) 


For each capture method investigated, a slightly different ERV was designed. For the propulsive capture 
method, the ERV had four 890 N NTO/hydrazine thrusters that performed the Mars orbit insertion (MOI) bum. For 
this mission, the capture bum lasted 51 minutes. The ERV used in aerobraking was also designed with four 
thrusters. The Mars orbit insertion bum duration for this case, however, was only 21 minutes because it was 
capturing the vehicle into a highly elliptical orbit. Upon completion of the aerobraking process, the ERV propulsion 
system also performed the bum for orbit circularization, lasting less than 2 minutes. From the Mars orbit insertion 
bum, the aerobraking process takes 170 days. 

The ERV design for the aerocapture method is somewhat different than the other two. A propulsion system is 
provided external to the aeroshell to perform the required trajectory correction maneuvers (TCM) as well as control 
the spacecraft through the Martian atmosphere. Upon exiting the atmosphere, the aeroshell and backshell are 
jettisoned and the ERV propulsion system is used to perform the circularization bum. This system includes only one 
890 N thruster. The duration of the atmospheric pass is approximately 12 minutes, leaving 54 minutes for aeroshell 
jettison and propulsion system preparation before the required circularization bum. As a result of having separate 
systems for TCMs and circularization, the ERV main propulsion system is not operational during the transit from 
Earth to Mars. 


IV. Data Sources 

During the course of the analysis, several data sources were used to provide both mission and system data. 
Baseline mission data and preliminary spacecraft designs were provided by the Team X group and the Mars 
Exploration Office at JPL. The Team X group provided a quick-look preliminary spacecraft design for this study. 
Where the Team X reports lacked detailed information, data was used from Mars Odyssey and Mars Global 
Surveyor. Both had ample mission data sets for the isolation of trends as well as detailed spacecraft design 
information. Bum profiles and timelines from Cassini and Mars Express were also used to supplement data for the 
propulsive capture analyses. 

Other mission details were provided from experts at NASA centers including the Marshall Space Flight Center, 
the Jet Propulsion Laboratory and the Langley Research Center 13,16,18,19,20 . Industry partners including Aerojet 3 and 
Lockheed Martin were also able to provide some detailed reliability data on spacecraft components. In addition to 
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component and mission data, several experts from both NASA and industry provided invaluable experiential data as 
a result of their involvement in previous missions. 

V. Subsystem An aly ses 

Since the goal of the study was to provide a relative risk comparison, only those subsystems that would 
contribute to a difference in risk were analyzed. Earth launch and interplanetary cruise were not analyzed, not were 
operations after Mars orbit establishment. Instrumentation, communication systems, power storage and 
management systems and propellant tanks were all assumed to be common between capture methods and therefore 
nondiscriminatory. Information provided for the subsystem analyses took the form of component failure data and 
calculated failure data based on physical characteristics of the systems. The subsystems that were investigated are 
discussed in the following sections. Unless otherwise stated, subsystem reliabilities were calculated using the 
standard equation, 


R = e~ M 


where X is the failure rate and t is time. 


A. Propulsion Systems 

To begin assessing the propulsion system of each capture maneuver, a schematic was constructed based on each 
of the Mars Sample Return (MSR) missions developed by Team X. Functional components were identified for 
analysis including the latch and solenoid valves as well as Reaction Control System and Attitude Control System 
(RCS/ACS) thrusters. Areas such as tank leakage/rupture, pressure transducers, and fuel feed lines were assumed to 
be negligible risk drivers and not analyzed. Propulsion risks were based on operational time, the number of 
components employed, and the dormancy time experienced. Four different size thrusters were used across the three 
methods, including 890N, 89N, 22N, and 0.7N thrusters. The 89N and 22N thrusters were assumed to have the 
same failure rate per reliability analyses conducted for each thruster by the Aerojet-Redmond operation 3 . All 
systems had high and low pressure latch valves and the high pressure valves were assumed one order of magnitude 
higher risk than the low pressure valves. Solenoid valves were assumed to operate during MOI, pop-up maneuvers, 
and circularization bums. High and low pressure latch valves were assumed open during the entire maneuver, 
therefore their respective failure rates were applied across the total time of the maneuver. 

Since all analysis begins at MOI, a dormancy time of three and one-half days was assumed for all propulsion 
components prior to the MOI bum. This is the assumed time that has passed since the last TCM. For aerocapture, 
the ERV propulsion components assumed a dormancy time of ten months or 300 days, which is the approximate trip 
time provided in the Team X mission outline. For aerobraking, it is assumed than an aerobraking maneuver (ABM) 
is performed on every orbit or 379 times. This assumption was made because actual ABM frequency and duration is 
unknown until the aerobraking maneuver is underway. Assuming a single ABM on each pass and combining the 
total operational and dormant time provides an approximation of these characteristics even if the maneuver is not 
performed this way. For propulsive capture, the RCS and ACS thrusters were assumed to cycle on and off 25 times, 
burning for approximately one minute and remaining off for one minute each cycle. Table 1 shows the approximate 
time of operation and dormancy used for each capture method. 


Table 1: Operation and Dormancy Times for Thruster Reliability Calculations 


Capture Method 

Total Operational Time 

Dormancy Time* 

Propulsive 

51 minutes 

N/A 

Aerobraking 

130 minutes 

2,500 hrs 

Aerocapture 

6 minutes 

7,200 hrs 


♦Dormancy time does not include the 3 ‘A days of dormancy prior to MOI that is assumed for all capture methods. 


B. Thermal Protection Systems 
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The TPS reliability estimates were based on the model by Rasky, which was adapted from classic machine 
design formalism 6 * The basic algorithm is based on the calculation of factor of safety (FOS) and index of reliability 
(IOR). The mean factor of safety (FOS) is given by: 



Where: 

T Lim,n = Mean value of the Limit Temperature of the Bond-line Material 
Tapp, M - Mean value of the internal TPS as result of applied heat load 
Tj iM = Mean value of initial internal temperature of TPS 

The index of reliability (IOR) is given by: 


Where: 


IOR = 


$ 


(FOS„- 1 ) 


fos;t\^x -t 1 


app,X ^ 


Tiim,x = Coefficient of Variation of the TPS Bond-line Temperature 
T app ,x = Coefficient of Variation of the applied TPS temperature 

The TPS reliability is computed according to the integration of the normal probability distribution: 


R 


TPS 


1UK i 
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For the aerobraking assessment, several parameters were obtained from the post-flight reconstructed analysis of 
the Odyssey mission. These included measurements of the maximum heating rate measured during each drag pass 
and the initial value of the solar panel temperature before each pass 8 . The data presented by Hanna for initial solar 
panel temperature of the Mars Odyssey spacecraft was curve fit for use in this analysis and can be see in Figure 3. 
Using the max heating rate, the maximum temperature rise of the solar panel was computed according to the 
correlation developed by Dec & Rasmussen based on detailed thermal PATRAN analysis 7 . The calculated Odyssey 
maximum temperature rise is shown in Figure 4. 


6 

American Institute of Aeronautics and Astronautics 



50 100 150 200 250 300 

Orbit Number 

Curve fit of Mars Odyssey Initial Solar Array Temperature 


Figure 3: 


O -30 
cn 
© 

■o -40 
P -50 



03 f- 

in 

CO 

r- O 


in 

CO 

*— 

03 


m 

CO 


03 

I s - 

m 

CO 

in 

h- 

03 O 

CM 

m- 

CO 

CO 

03 

T— 

CO 

in 


CO 

O 

CM 



T— 

r- 

T— 

T— 


T_ 

CM 

CM 

CM 

CM 

CM 

CO 

CO 


Orbit Number 

Figure 4: Maximum Calculated Temperature Rise from Mars Odyssey 


The FOS was then computed assuming a temperature limit of 195 C, The mean values and standard deviation of 
the applied temperature rise were computed over all the drag passes of the Odyssey mission to determine the 
coefficient of variations used in the IOR computation. The mean values and standard deviation of the limit 
temperature difference were similarly determined. 

The aerocapture thermal protection system reliability analysis also leveraged historical data. Several inputs were 
determined from the post-flight reconstructed analysis of the Mars Pathfinder mission due to the assumed use of the 
same aeroshell TPS material (SLA-561 V). Initially, the internal TPS temperature rise was obtained by scaling the 
Mars Pathfinder stagnation point internal temperature measurement by the ratio of the heat load with respect to the 
present mission. 

However, Team X assumed the same engineering FOS of the Pathfinder mission during the design of the 
aeroshell under investigation. It was then determined that no correction to the temperature rise was to be used for 
this analysis. The assumption was made that the TPS design thickness was large enough to accommodate a similar 
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FOS to the Pathfinder mission. For this study, the value of maximum temperature of 228 K is used. The initial 
internal temperature of the TPS material around the stagnation point derived from Mars Pathfinder measurements is 
approximately 198 K 6 . The limit temperature of SLA-561 V, based on material data, is 523 K 10 . The coefficient of 
variation of the applied and limit temperatures were assumed to be 10 and 13%, respectively, based on the 
compilation of historical data of TPS materials 8 9 . 

C. Guidance Navigation & Control Hardware 

The failure rates used to assess the hardware of the Guidance, Navigation, and Control (GN&C) subsystem were 
obtained from a subset of the Space Shuttle GN&C rates during its return trajectory 4 . The Space Shuttle uses 
autonomous controls during reentry for guidance and navigation thus providing adequate similarity to the capture 
methods assessed since the capture at Mars uses some level of autonomous control for all three maneuvers. The 
failure scenarios for the hardware include loss of redundancy due to common cause failures and include the 
accelerometer assembly, rate gyro assembly, power bus, and inertial measurement units (IMUs). Star trackers were 
assessed for the aerobraking maneuver for time in between atmospheric passes, but contributed negligible risk. The 
risk differences for the three maneuvers are primarily a function of the exposure time of the components. During 
aerobraking and aerocapture, the exposure time is equivalent to the amount of time the vehicle is in the Martian 
atmosphere. For propulsive capture, exposure time is equivalent to the duration of the orbit insertion bum. See 
Table 2 for a comparison of these operational times. 

D. Software 

The reliability of software, in particular the guidance algorithms used for aerocapture, was also investigated in 
this study. Initially, a method of computing software reliability was sought that correlated reliability with lines of 
code and duration of operation of that code. A method developed by Schneidewind and originally used for risk 
analysis of the Space Shuttle software systems was selected 17 . Inputs to the model include total test time, 
operational time, lines of code and number of errors present in the code before and after testing. The Schneidewind 
method is based on the following equations 17 : 

R = exp(— (fc * n slart * exp (-a * T test )) * T op 

k = ^ 

T M* n «ar,* Q xp(-a*T ml ) 


j r ~ ln (”^/'W) 

7L 


Where: 

R « reliability 

n star t = number of errors prior to debugging 

Hend = number of errors after first debugging interval 

T^t = Time of test interval 

Ttest = Total test time 

T op = Operational time 

The baseline guidance algorithm for aerocapture was assumed to be the HYPAS algorithm with a code that is 
slightly more than 300 lines long 13 . The total length of code for Mars Odyssey is 48,500 lines 12 . Given the short 
nature of the aerocapture guidance algorithm and the total length of code for Mars Odyssey, it was assumed that all 
three software packages would be 48,500 lines long. The number errors per thousand lines of code before and after 
the first test interval were assumed to be the same as the Space Shuttle. The same test time and test interval length 
was assumed for all three capture methods. The relative risk of software was then determined by the total 
operational time and an assumed percentage of software failures leading to a loss of mission. Propulsive capture and 
aerocapture had relatively short operational times compared to aerobraking, however aerobraking and propulsive 
capture were assumed to have the lowest sensitivity to software errors. See Table 2 for the specific operational 
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times. The 80 minutes used to represent operational time for aerocapture include the 12 minutes of atmospheric 
operation time as well as the 68 minutes of time from atmospheric exit to the periapsis raise bum. 


Table 2: Exposure Times for GN & C and Software Calculations 


Capture 

Method 

Exposure Time 

% of Software Failures 
Leading to LOM 

Propulsive 

80 minutes 

0.3% 

Aerobraking 

21,420 minutes* 

1% 

Aerocapture 

80 minutes 

10% 


*Aerobraking exposure time only includes the time in which the vehicle is within the Mars atmosphere. 


E. Solar Arrays 

Solar panel degradation and array deployment mechanisms were also investigated for their contribution to risk. 
For this analysis solar panel degradation is based on data obtained from satellites. The methodology consists of 
determining a nominal solar array degradation factor based on data from Price and shown in Figure 5 11 . 



Mission Time (Years) 

Figure 5: Solar Array Degradation Factor as a Function of Mission Time 


The reliability of the solar panel due to degradation is computed according to: 


^SP.Deg ~ 1 & e g) * X cat 


Where: 

Deg = Solar Array Degradation Factor 

X^t = Percentage of Solar Array Degradation Failure that contributes to loss of mission (1%) 

The discriminating factor for solar array degradation risk is the exposure time of the panels during the transit. 
The aerocapture solar panels that are used for the ERV are packaged inside the aeroshell for the transit to Mars and 
therefore experience no degradation, compared to the other two methods for which the solar arrays are exposed from 
Earth departure. 
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For solar panel deployment mechanisms, the opposite is true. The aerobraking and propulsive missions have 
solar panels that are deployed early in the trans-mars-cruise phase. The aerocapture mission does not have solar 
panels deployed until the end of the aerocapture phase, indicating that there is a dormancy period inherent in the 
aerocapture solar array mechanism risk. This, however, was a minor factor given the overall assumption that the 
array deployment mechanisms were highly reliable. 

F. Navigation Targeting 

This assessment addressed the risk of inaccurate targeting of a precise point in space prior to arrival at Mars 
leading to an unsuccessful capture. These points are different depending on the maneuver, however the accuracy of 
the prediction tools was assumed to be the same. The relative risk differences occur due to the various tolerances to 
this prediction for each of the capture methods. The accuracy data used for this analysis was based on the Mars 
Exploration Rovers for direct entry. The direct entry spacecraft of the MER missions hit their target for entry 
alignment to within +/- 200 meters without performing their final TCM. The assumptions for the tolerances of each 
capture method are as follows. For aerocapture, the tolerance is +/- 2 km, while the tolerance for aerobraking is +/- 
20 km. Finally, the tolerance for propulsive capture is +/- 200 km 54 ’ 21 . This implies that if the vehicle’s targeting 
was off more than the relevant tolerance, then the mission would be lost. A standard normal distribution with p * 0, 
or = 200m, and x as the various tolerances for each method was assumed. Given the high tolerance of all three 
capture methods relative to demonstrated accuracies, the probability of missing the predicted target with a given 
accuracy outside of its tolerance is insignificant for all three capture maneuvers. 

G. Atmospheric Prediction 

Risks associated with atmospheric density variations were assessed for the aerobraking and aerocapture 
maneuvers only. The propulsive capture profile never positions the vehicle within the Mars atmosphere. Incorrect 
predictions of the atmospheric density will lead to thermal failures in both aerobraking and aerocapture spacecraft. 
The risk for the aerocapture maneuver is obtained from the Aerocapture Team X report for the mission 20 . The report 
states that over 2000 Monte Carlo simulation runs resulted in a certain percentage of successful captures and that the 
model included variations in delivery, aerodynamics, and atmospheric density. Since the fraction of failures caused 
by atmospheric density alone is not known, this overall percentage assumed a conservative risk estimate. 
Assessments of inaccuracies of atmospheric prediction tools (such as Mars-GRAM) are difficult to perform given 
that flight data is unavailable to validate the models of the Martian atmosphere at the altitudes encountered during an 
aerocapture maneuver. It was for this reason that the study team turned to the Team X stated approximation for 
capture success. 

For aerobraking, atmospheric density data is known for completed orbits throughout the maneuver. Data from 
previous orbits is used to correct atmospheric predictions for subsequent passes. Atmospheric density predictions 
for aerobraking can be directly tied to thermal limits and observed heat transfer rates from previous missions. The 
heating rate data from Mars Odyssey along with the thermal limits were used to evaluate the accuracy of prediction 
procedures during aerobraking 5 . The heating rate data was fit to a distribution and run through a Monte Carlo 
simulation. The percentage of time that data points from the simulation exceeded the thermal limit boundary was 
calculated. This value was used as a risk estimate that represents the failure probability of losing a mission due to 
incorrect atmospheric density predictions that lead to thermal failures given that this would be the most likely 
primary failure mode resulting from incorrect density predictions. 

H. A Qualitative Discussion on Human Reliability 

The original plan for this study included an analysis of human reliability factors. It was indicated by several 
experts with experience in aerobraking procedures that the reliance on humans for many of the day-to-day processes 
should be considered as a risk factor when discussing relative risk. While human factors can not be entirely 
dismissed, several factors led to the inclusion of human reliability on only a qualitative level. 

In a study that investigated failures of Earth orbiting satellites and deep space probes, a group of researchers 
from the Air Force Research Laboratories indicated several major candidates for corrective action that would 
prevent operational anomalies caused by human error 1 . The three most significant candidates were training, better 
adherence to procedures and better procedures. The least significant candidate area for improvement was high 
pressure or informational overload environments. Given this information, the processes, procedures and 
environments surrounding a typical aerobraking maneuver were studied. Through conversations with experts who 
had participated in Mars Odyssey and Mars Global Surveyor, several conclusions were drawn. 
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The first conclusion to be drawn is that the level of expertise of those involved in the daily decision making 
process is very high. Teams assembled for these capture maneuvers are experts in their field and, thus, highly 
trained. Second, the procedures for aerobraking are very well defined and interfaces between the ground and the 
spacecraft are simplified to reduce the likelihood of an errant command being uploaded to the spacecraft. Finally, in 
every decision made, there are several experts working in parallel, using reliable calculation tools and arriving at 
consensus on decisions before proceeding. Given ail of these factors, the three major areas identified as problematic 
for human reliability in space systems by the AFRL paper are unlikely candidates for causing mission failures 

Finally, a qualitative assessment has been provided because methods for assessing quantitative measures of 
human reliability are scarce. Most human reliability assessment methods deal with high pressure environments such 
as wartime operation of a submarine or emergency response of nuclear power plant operators. High pressure and 
information overload environments have been identified as a small contributor to spacecraft failure due to human 
error, mostly due to the fact that these environments do not typically exist in these areas of operation. With the 
possible exception of operations near the end of the maneuver (when orbital periods are short and decisions require 
fast calculation turn around), the same can be said of aerobraking. While human factors can not be completely 
discounted, quantifying their level of risk in capture maneuvers is extremely difficult and has been left for future 
study. 


VI. Analysis Results 

The results were calculated by relatively comparing the reliability between the three capture maneuvers. 
Propulsive capture was selected as the normalized reliability value throughout subsystem and overall calculations. 
The aerocapture maneuver was the closest to propulsive capture in overall reliability, showing results slightly more 
than 0.5% below propulsive capture reliability. Aerobraking posed the highest risk of all three capture maneuvers, 
but relatively, there was only a 1 .5% decrease in reliability from propulsive capture. Figure 6 shows the percent 
reduction in reliability when compared with propulsive capture for both aerobraking and aerocapture. The 
comparisons for all the major subsystems investigated are provided as well as the overall reliability decrease. 
Having little or no bar on the graph does not mean that the subsystem poses zero risk, but instead that the risk is 
roughly the same as propulsive capture. 
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Figure 6: Comparison of Reduction in Reliability from Propulsive Capture 


The drivers for the propulsive capture loss of mission risk were solar array degradation, propulsion failure, and 
GN&C hardware failure, which contribute about 66%, 28%, and 6% of the risk, respectively. Other subsystems 
analyzed in this study had irrelevant risk during the maneuver. The drivers for aerocapture were propulsion system 
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failures and miscalculations in atmospheric density, which contribute approximately 48.5% and 47.5%, respectively. 
Subsystems having insignificant risk during aerocapture were GN&C hardware and software failures. The thermal 
protection system and solar array deployment after circularization added the remaining 4% of the risk. All 
subsystems with the exception of TPS contributed to the aerobraking risk. The top drivers were GN&C hardware, 
software failures, atmospheric density calculations, and the propulsion system contributing 40%, 26%, 1 7%, and 
15% of the risk, respectively. Figure 7 displays the overall relative reliability, normalized by propulsive capture, 
and the major risk contributors to each maneuver. 



Propulsive Aerobraking Aerocapture 


Figure 7: Relative Reliability Comparison with Major Risk Drivers for Each Maneuver 

As previously mentioned, the thermal protection system poses no relative risk for propulsive capture because the 
vehicle does not enter the atmosphere and experience thermal heating due to atmospheric drag. Similarly, 
aerobraking does not have a high thermal risk even though solar panels drag through the atmosphere throughout the 
process. The low risk is due to the amount of margin designed into the vehicle and materials, but the navigational 
decisions made during aerobraking also reduce thermal heating loads. Similarly, analysis of the aerocapture vehicle 
yielded insignificant thermal risk. Previous studies reflected a low thermal risk or high safety factor for the Mars 
Pathfinder mission, which was directly applied here because the same material was used for the aeroshell. With size 
and thicknesses scaled for the aerocapture vehicle, the analysis also reflected a high safety factor translating to very 
low risk. Therefore, thermal risk was not a significant contributor to any of the capture methods. 

For GN&C and software systems, the risk differences were a function of exposure time since hardware 
components are assumed the same on all three missions. During propulsive capture and aerocapture, the GN&C 
components are operating for approximately eighty minutes. However, for aerobraking, the GN&C components are 
active for approximately 360 hours over the three months it takes to complete the process. Similarly, aerobraking 
has the longest software exposure time and possesses the only noteworthy relative risk due to irrecoverable software 
failures. 

Atmospheric density prediction risk is not experienced by propulsive capture maneuvers because, as mentioned 
above, the spacecraft does not enter the atmosphere for this maneuver. The risk estimates for aerobraking and 
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aerocapture were almost identical even though the assessment approach for each was different. In relative terms, the 
reliability of atmospheric density predictions contributed approximately 16% to the risk of aerobraking but 
contributed approximately 47% to the risk of aerocapture. 

For failures concerning solar arrays, all three capture methods had similar risk values, within less than half an 
order of magnitude. Propulsive capture and aerobraking experience similar degradation risk with the only 
distinction being their trip time to Mars (seven and ten months, respectively). Aerocapture does not contain the 
degradation risk since the solar panels used on the way to Mars are integrated into the aeroshell and discarded after 
the atmospheric drag pass. The solar arrays responsible for the primary power supply to the orbiter are not deployed 
until after the circularization bum at Mars. Therefore, the primary risk is due to the dormancy time experienced by 
the deployment mechanisms of the solar arrays during the ten month trip to Mars. This estimate is not statistically 
different than the degradation risk for the other two maneuvers. Therefore, little relative risk difference is seen 
between the maneuvers, however aerocapture presents the smallest absolute risk. 

The propulsion system risk of the propulsive capture maneuver is smaller than the other two maneuvers by an 
order of magnitude. Though different sizes and combinations of thrusters are used in all three capture maneuvers, 
the primary failure scenario that drives aerobraking propulsion system risk higher than propulsive capture is the 
dormancy time experienced by the thrusters during the ninety day aerobraking process. Aerocapture produces a 
very similar risk to aerobraking and the driver is also related to dormancy. However, this risk is the result of 
propulsion components of the ERV being dormant for the entire trip to Mars and then being first activated for the 
post-drag-pass circularization bum. 

It should be noted that there is a reason that a failure scenario such as solar panel degradation would be a primary 
risk driver within the propulsive capture maneuver, yet hardly a significant contributor in aerobraking, even though 
their risk estimates are statistically the same. This can be realized from the aforementioned subsystem comparisons 
which show that propulsive capture inherently contains fewer sources of risk as compared to aerobraking. Similarly, 
even though the risk estimates are almost equal, atmospheric density failures contribute to almost half of the total 
aerocapture risk. These failures are a small contributor to the aerobraking maneuver since GN&C and software 
mishaps have relatively higher risks. While risk estimates between capture maneuvers may be similar in magnitude, 
their affect on individual maneuvers is entirely dependent on the cumulative possible failure modes that exist in each 
maneuver. 


VTL Conclusions 

There exists very little relative difference in the reliability of propulsive capture, aerobraking and aerocapture. 
While different subsystem risks contribute to the overall risk of each maneuver, the overall risk is veiy similar. For 
propulsive capture, solar array degradation, propulsion system failures and GN & C hardware failures were the 
significant contributors. Aerobraking was most affected by GN & C hardware failures, software failures and 
atmospheric density prediction errors, the first two being driven entirely by the extended operational period inherent 
in aerobraking. Propulsion system failures, driven mostly by dormancy failures, and atmospheric density prediction 
errors were the significant contributors to aerocapture risk. Human factors were only assessed qualitatively, 
however they would most affect the aerobraking reliability if the risk was to be quantified. 

The relative numbers presented as a result of this study assume that an Earth demonstrator flight has flown for 
aerocapture. The most important benefit of this assumption is the knowledge from that Earth demonstrator that all 
of the aerocapture components can be integrated properly. Assuming that this is the case, the reliability of the 
maneuver can be based on the reliability of the components used to perform the maneuver. At some level, almost 
every component required for an aerocapture vehicle has flown on a spacecraft before. Given this, it is not 
surprising that the relative reliabilities of these three capture techniques are comparable. While this study represents 
an important first step in the aerocapture decision process, it is equally important to revisit this assessment with the 
most current data and with new risk contributors to develop the most complete and accurate risk assessment 
possible. Quantifying the risk of aerocapture will provide more significant guidance than the simple '‘gut feer 
assessments that currently exist. With quantified data, mission planners will be better informed, allowing them to 
accurately weigh the benefits and drawbacks of the various capture techniques available to aid in the exploration of 
our universe. 
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